Skip to main content
Read this once before installing. If you can check every box in You are ready when…, the install will succeed.

​
Supported environment

“1.24+” is the recommended floor; it is not enforced by the chart. Very old clusters may work but are untested.

​
Resource footprint

No PersistentVolumeClaims are created. The collector runs non-root with a read-only root filesystem and all Linux capabilities dropped.

​
Network

  • Outbound HTTPS (TCP 443) from the cluster to api.changeguard.ai (TLS 1.2+).
  • DNS resolution for api.changeguard.ai (and install.changeguard.ai if you use the one-line installer).
  • Image pulls from public.ecr.aws (or your mirror — the chart supports a custom global.imageRegistry for air-gapped setups).
No outbound HTTP proxy support today. The collector needs direct HTTPS egress; HTTP_PROXY / HTTPS_PROXY env vars are not honored by its push client. If your cluster only reaches the internet through a proxy, contact us before installing.

​
Permissions to install

You need rights to create namespaces, a CRD, ClusterRoles/Bindings, and Deployments. cluster-admin is not required, and ChangeGuard requests no wildcard RBAC. See Permissions for the exact grants (including that the operator and collector read Secrets and RBAC objects cluster-wide, read-only).

​
Credentials & secrets

  • A ChangeGuard API key (create one at app.changeguard.ai → API keys). Treat it like a password.
  • The chart creates one Kubernetes Secret, changeguard-credentials (key api-key), in changeguard-agent. You can also create it yourself and reference it.

​
Data collected vs. not collected

​
What the installer changes — and doesn’t

Creates: namespaces changeguard-system and changeguard-agent; the changeguardagents.changeguard.ai CRD; the operator (Deployment + RBAC); a ChangeGuardAgent custom resource; the collector Deployment; one Secret; optionally scanner CronJobs/DaemonSet. Does not change: any of your existing workloads, your RBAC for other principals, your Secrets, or your CI/CD — unless you later opt into remediation and apply its namespaced RBAC.

​
You are ready when…

Next: Install →